Spyware.FFDroider

Short bio

Spyware.FFDroider is Malwarebytes detection name for an information stealer that targets social media credentials on Windows machines.

Type and source of infection

Spyware.FFDroider searches the affected system’s browsers for login credentials and valid session cookies to run malicious advertisements from the victim’s account and utilize the compromised accounts payment method to spread the malware further. Spyware.FFDroider is offered on download sites pretending to be installers for freeware and cracked versions of paid software.

Protection

Malwarebytes blocks Spyware.FFDroider

Home remediation

Malwarebytes can detect and remove Spyware.FFDroider without further user interaction.

1. Please download Malwarebytes to your desktop.
2. Double-click MBSetup.exe and follow the prompts to install the program.
3. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
4. Click on the Get started button.
5. Click Scan to start a Threat Scan.
6. Click Quarantine to remove the found threats.
7. Reboot the system if prompted to complete the removal process.

Business remediation

How to remove Spyware.FFDroider with the Malwarebytes Nebula console

You can use the Malwarebytes Anti-Malware Nebula console to scan endpoints.

Nebula endpoint tasks menu

Choose the Scan + Quarantine option. Afterwards you can check the Detections page to see which threats were found.

On the Quarantine page you can see which threats were quarantined and restore them if necessary.

IOCs

Files and folders:

The malware creates a directory in %UserProfile%Documents named VlcpVideov1.01

In this folder it drops the file:

Install.exe

The malware is hosted online as:

vinmall880.exe

vinmall1.exe

lilay.exe

SHA256 hashes:

3596982adf10806e7128f8f64621ec7546f4c56e445010523a1a5a584254f786

7eb7bd960e43164184e41cdacf847394a5aa8b7bce357d65683bc641eef3381b

94031fe0fbda71abdfa4f51c370d0da17deae7578549a81335dfbb446f75c474

d7e81d5c26a9ff81d44ff842694b1a8732211e21ac32a471641c4277c1927ca5

Subdomain:

download.studymathlive.com

IPs:

C2: http://152.32.228.19/seemorebty

Update server: http://186.2.171.17/seemorebtu/poe.php?e=

Registry key:

HKCUSoftwareffdroiderFFDroider